Assembly Bill A235

                                BILL NUMBER:A235

TITLE OF BILL:  An act to amend the general business law, in relation to
the disclosure of social security numbers

PURPOSE OR GENERAL IDEA OF BILL:  To restrict the unnecessary dissem-
ination and collection of Social Security Numbers thereby protecting the
personal privacy of New Yorkers.  To extend the privacy protection of
the federal Privacy Act of 1974.

SUMMARY OF SPECIFIC PROVISIONS:  This bill tracks the intent of the
federal Privacy Act of 1974 by stipulating that every person, firm,
partnership or corporation which requests a social security number from
an individual must reveal in writing or orally when the request is made
orally of the authority for the solicitation of the information, whether
disclosure is mandatory pursuant to federal law or regulation and the
purpose of the information. Where there is no legal basis for the
request, a person may refuse to provide his/her social security number.
In such cases, the person shall not be denied any service.  The bill
further provides for enforcement by the Attorney General.  Whenever the
court shall determine that a violation involving disclosure has
occurred, the court may impose a civil penalty of not more than five
hundred dollars. The second or subsequent violation shall be punishable
by a civil penalty of not more than one thousand dollars. Moreover, as
provided in other statutes, the bill provides for damages, where appro-
priate.
              

EFFECTS OF PRESENT LAW WHICH THIS BILL WOULD ALTER:  The General Busi-
ness Law is amended by adding a new section 394-f.

JUSTIFICATION:  Increasing demands are being placed on individuals to
furnish a Social Security Number in circumstances when the use of the
SSN is neither required by the federal government for federal program-
matic purposes or necessary.  For example, some stores and supermarkets
demand Social Security Numbers for check cashing and other unknown
purposes, and utilities, and cable companies request Social Security
Numbers to grant service.  Finally, some companies request Social Secu-
rity Numbers on contest entry forms.  Consumers are frequently given the
impression that such information is required.  In some instances, the
disclosure of one's SSN has been made a condition for obtaining
services.

The SSN is increasingly being used as a password or an authenticator of
identity.  The Social Security Number is becoming a de facto identifica-
tion number. Credit records are indexed by SSN; some banks and credit
unions even use it as an individual's account number. Several universi-
ties use the number for both student and faculty ID numbers and many
health plans use the SSN to identify their subscribers. Such use is not
necessary, just convenient and can be risky, since the widespread circu-
lation of SSNs makes them increasingly ascertainable by anyone wishing
to impersonate another and invade personal privacy.  In application
fraud, for example, someone simply files bogus credit card applications

using the person's name and SSN. The thief then runs up large bills on
someone else's account and, of course, does not pay them.  Most consum-
ers who have been victims of this form of fraud are not aware of the
problem until months later, frequently when they begin receiving dunning
letters from creditors. By that time, their credit history has been
damaged.  It has also become common for illegal aliens to provide false
Social Security Numbers when they seek employment. The scrambled earn-
ings records create a nightmare for the rightful owner. Unemployment
compensation claims have been rejected because other individuals were
already collecting unemployment benefits on the rightful owners'
numbers.

The proliferation of the use of the SSN makes it easier for large organ-
izations and institutions to compare their databases. While government
is prohibited from computer matching, private organizations are not.
Thus, by providing a Social Security Number for a non-governmental or
non-mandated purpose, individuals are providing organizations with the
means to access other data about them in disparate data banks without
the knowledge or consent of the data subject to manipulate personal
information and create detailed profiles and dossiers.

In addition to data matching by large institutions, the SSN allows curi-
ous individuals, people you might not want, to snoop into private
records hopping from database to database consisting of various insur-
ance, business and medical records to draw out a profile. As stated by a
computer security expert, once someone has a person's Social Security
Number, he or she can get somebody's life history.

The SSN in its present form is not a satisfactory identifier. There is
no real security for institutions in relying on the SSN.  SSNs are too
often transposed to create accidental inaccuracies.  Moreover, individ-
uals often secure or create multiple SSNs.  Furthermore, the Social
Security Administration adheres to a policy of responding to requests
for the verification of numbers from only those institutions that are
authorized to maintain and record such data.

Finally, the federal Privacy Act of 1974 requires federal, state and
local governmental agencies requesting SSNs to cite its formal legal
authority, reveal whether disclosure is mandatory or voluntary and
explain how the number will be used. Enactment of the proposed law would
extend this needed protection to the private sector.  In addition, the
bill is consistent with the recommendations of the report, Records,
Computers, and the Rights of Citizens, issued by the U.S. Department of
Health, Education and Welfare.

PRIOR LEGISLATIVE HISTORY:  A.334 of 2008, A/638 of 2006, A.532 of 2004,
A.722 of 2002, A.700 of 2000.

FISCAL IMPLICATIONS FOR STATE AND LOCAL GOVERNMENTS: None.

EFFECTIVE DATE:  This act shall take effect on the one hundred twentieth
day after it shall have become law.